Answer in brief
CVE-2026-111190 records a High severity (CVSS 8.1) vulnerability in ARForms <= 7.2.4 - Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header. The current sources do not mark it as known exploited. The current feed maps n/a/ARforms (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps n/a/ARforms (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| n/a/ARformsgeneric | >=0 <=7.2.4 | Not reported |
Published upstream
Nov 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 11, 2026
The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its form file-upload handler. The name of the stored file is taken from an attacker-controlled request header and is not adequately restricted to safe file types, and the plugin's file-type and content-safety checks can be evaded, allowing files that contain executable PHP code to be written to a publicly accessible directory. This makes it possible for unauthenticated attackers to upload malicious files to the affected site's server, which may make remote code execution possible. Exploitation requires a published form containing a File field to be publicly accessible on the site.
Quoted source text, attributed separately from HOL analysis.